WEBSITE ANALYSIS REPORT

https://login.microsoft.com//////////////////////////////common/oauth2/v2.0/authorize?state=hgtyu478&scope=openid+profile+https%253A%252F%252Fgraph.microsoft.com%252FUser.Read&prompt=none&client_id=ebe678e2-e1c9-4e86-8ebf-eb4035d1b2c5&uri=https%253A%252F%252Fdeveloper.salesforce.com%252Fdashboard%252Fsession%252Fuser%252Fverify%252Fstep1&%255Ca3edq%250C+2e4c%250D%250A%2593bb66f835%2509%258C2979X%25BCint+Builder.Decode%250A%2509Context+%253A%253D+FlowEmail+%255B+OffsetStream+%253A=%2520Token%2509Data%2520%257C%2520Email%257Dfor%2520Stream%253A%253DPayloadBuilder+;+ValueContext+%257D+Trace%250A%2509Decode+.+SignalVector+%257B%2520Offset%257D%250Aa78c998ef06b569e%2597%25E9%252A%25CBa93627d06a07eba872664f4a92c74eae25f60308d1cad09a16e7beef0b79c03d8bd7528c4a7efc8bdb3fc053evar%252BVector-Secret%25250A%252509Decode%252B%25253B%252BBuffer%25250A%252509Encode%252B-%252BSession%25250A%252509Decode%252B%25255D%252BPayload%25250A%252509Offset%252B%25252B%252BBuilder%25250A%252509Builder%252B%252528%252BToken%25250A%252509Encode%252B.%252BKey%25250A%252509Context%252B%25257B%252BToken%25250A%25257D%25250Aelse%252BDecode%25252CBuilder%25250A%252509Stream%252B%25253A%25253D%252BHeader%25250A%252509Vector%252B%252526%252BVector%25250A%252509Payload%252B%25253D%252BBuilder%25250A%252509Value%252B%25257C%252BPayload%25250A%252509Secret%252B%25253D%252BBuffer%25250A%25257D%25250Aswitch%252BPayload%25252CSession%25250A%252509Payload%252B%252529%252BToken%25250A%252509Payload%252B%252526%252BBuilder%25250A%252509Data%252B%25257C%252BDecode%25250A%252509Secret%252B%25255B%252BStream%25250A%25257D%25250Astring%252BBody%252529Session%25250A%252509Session%252B%252528%252BTrace%25250A%252509Buffer%252B%25257B%252BSession%25250A%252509Vector%252B%25252A%252BVector%25250A%252509Context%252B%25253B%252BToken%25250A%252509Value%252B%25252A%252BData%25250A%252509Encode%252B%25253B%252BFlow%25250A%252509Trace%252B%252529%252BTrace%25250A%25257D%25250Aint%252BToken%25257CSignal%25250A%252509Header%252B%25255D%252BFlow%25250A%252509Body%252B.%252BKey%25250A%252509Vector%252B%252528%252BSignal%25250A%252509Session%252B%25252C%252BData%25250A%25257D%25250Ac2FuZGVlcEBmdmNvbS5hZQ==

14 Oct 2026 · 19:29:26.000 UTCpublic

Report tags: malicious cloaking browser_fingerprinting anti_analysis
Submit tags

Request review

Malicious detection

2 detections · review the detection signals

Review evidence →

Domain graph

Hostnames and connections captured in this scan

Loading domain graph…

Network requests

Click any request row to expand it in place. Multiple transactions can remain open.

UTC · milliseconds

Timestamp (UTC) Method Status Host / path Type Size Duration Signals

19:19:42.382 GET 302 document 0 B 2480 ms —

19:19:44.878 GET 302 document 0 B 2632 ms —

19:19:47.518 GET 301 document 0 B 101 ms —

19:19:47.632 GET 200 document 1.3 KB 724 ms 2 alerts

19:19:48.668 GET 200 script 4.3 KB 34 ms 2 alerts

Transaction #03

Request / response

URL

GET HTTPS

https://592cataclysmal.buyoro.com.de/418helmsman/utils.ab41f5f99a7e350ab9c6.js

IP / ASN

188.114.96.1

AS13335 · CLOUDFLARENET

Requested by: https://592cataclysmal.buyoro.com.de/418helmsman/

Resource information

File type: JavaScript source, ASCII text
MIME type: text/javascript
First seen (UTC): 16 Sep 2026 · 14:04:00.850 UTC
Last seen (UTC): 19 Oct 2026 · 19:40:23.784 UTC
Times seen: 14

Size: 4.3 KB (4365 bytes)
MD5: c08de6870fb8a7de040c7db5ad2b4893
SHA1: 13bb5c3bf6c73bbb7f6c5e400f1473abdef6444e
SHA256: 05aeccef02b837d574df5ec3259d84fd395f07d3f0bc33b5c7fa435fc2fae59e

Certificate information

Issuer: Let's Encrypt · YE1
Subject: buyoro.com.de
Protocol / cipher: TLSv1.3 · TLS_AES_128_GCM_SHA256
SHA1 fingerprint: 2A:41:B4:86:32:2E:98:1F:48:5C:3C:11:94:A1:21:5F:D2:3C:BB:C3
Valid from: Sat, 29 Aug 2026 16:09:01 GMT
Valid until: Fri, 27 Nov 2026 16:09:00 GMT

Technology fingerprints

Cloudflare (CDN)
HSTS (Security)

Detections

Detection observations attached to this HTTP transaction.
Detection	Severity	Verdict
urlquery Malicious - Cloaked Browser Fingerprinting	medium	Malicious
Quad9 DNS Sinkholed	medium	Malicious

HTTP headers

Request headers

GET /418helmsman/utils.ab41f5f99a7e350ab9c6.js HTTP/1.1
Host: 592cataclysmal.buyoro.com.de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate, br, zstd
Referer: https://592cataclysmal.buyoro.com.de/418helmsman/
Sec-GPC: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

Response headers

HTTP/3 200 
date: Wed, 14 Oct 2026 19:19:48 GMT
content-type: text/javascript
content-length: 1594
etag: "110d-6aa97800-3806b9;br"
last-modified: Tue, 15 Sep 2026 16:53:20 GMT
accept-ranges: bytes
content-encoding: br
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
referrer-policy: no-referrer-when-downgrade
content-security-policy: default-src 'self' https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none'; upgrade-insecure-requests;
age: 6221
cache-control: max-age=14400
cf-cache-status: HIT
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=okq%2Fnk72rgboFvnSMVeMgKpDBG4XFyyrcPPgS3jFN%2FX3hjL%2FoxoRCt7d8yxbjn%2BDpM%2FJKWQ6rhp0RRDVNF27W4tacKrkjJ1xQB%2BNVYq77V0QUupj5MZCLzEMe3yDONrohn6NmuRdcUELXjGn10U6"}]}
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
priority: u=3,i=?0
server: cloudflare
cf-ray: a4a8f0112ab156b7-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri

19:19:48.854 GET 200 img 134 B 576 ms 2 alerts

19:19:51.730 POST 200 document 0 B 0 ms 2 alerts

19:19:53.058 GET No response document 0 B 0 ms —

Domain graph

Hostnames

Connections

Network requests

Transaction #03

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

Display preferences

Go to…

Notifications

Full request body

Full screenshot

[Domain graph]

Hostnames

Connections

[Network requests]

Transaction #03

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

Domain graph

Network requests